How North Korea laundered money through Vietnamese crypto company

On Sept. 22, 2025, a post seeking a verified U.S. Payoneer account appeared on a Telegram channel run by Quangvietdnbg International Services Co. Ltd., a Vietnamese online financial company.

At first glance, it appeared to be a routine post seeking to buy a borrowed-name account on Payoneer, the electronic payments platform. Quangvietdnbg, however, was later found to have been involved in laundering money for North Korea.

Last month, the U.S. Treasury Department’s Office of Foreign Assets Control added Amnokgang Technology Development Co., based in Pyongyang, and Quangvietdnbg to its sanctions list targeting individuals and entities linked to North Korea. According to the Treasury, Amnokgang arranged for North Korean information technology workers to obtain overseas jobs under false identities, while Quangvietdnbg laundered the wages they earned and sent the money back to North Korea.

Quangvietdnbg International’s official Facebook account. The company promotes itself in a polished and professional manner, with little sign that it was allegedly involved in laundering money for North Korea. Captured from Facebook

Quangvietdnbg and its CEO, Nguyen Quang Viet, “converted approximately $2.5 million into cryptocurrency for North Koreans” by orchestrating IT worker schemes that “systematically defraud U.S. businesses and generate revenue to fund the DPRK’s weapons of mass destruction programs,” the Treasury said. All of their U.S.-based assets were frozen and transactions halted.

DPRK stands for North Korea's official name, the Democratic People's Republic of Korea.

A report by Hankook Ilbo on Thursday found that Vietnamese authorities revoked Quangvietdnbg’s business license shortly after the U.S. sanctions were imposed. Its Facebook page and Telegram channel, however, remained accessible.

A review of the company’s posts offered a glimpse into how Quangvietdnbg appeared to operate in three steps: recruiting clients through Facebook, moving transactions to Telegram, and converting the proceeds into cryptocurrency before remitting them. The case showed how open social media platforms could be exploited.

A post on Quangvietdnbg’s Telegram channel. Captured from Telegram

Disguised as a professional crypto exchange business

Using images of smiling children on Facebook, the company portrayed itself as a “trusted, professional and leading” player in the Payoneer-to-crypto exchange business. The actual transactions, however, were carried out through Telegram channels linked to its Facebook page.

For North Korea, whose access to the international financial system has been heavily restricted by U.S. sanctions, these laundering operations are effectively one of the few ways to aquire money from overseas.

Its Telegram channel, with 1,345 members, was run as an announcement-only space with posting accessible only to administrators. The channel administrator posted the first notice offering cryptocurrency exchange services in September 2022. Since then, the channel had built credibility by disclosing its cryptocurrency holdings, exchange fees and transaction records.

At one point, it even held a thank you event, giving $10 each to 10 clients who had traded more than $1,000 after the company reached 10,000 feedback entries on Paxful, an online cryptocurrency exchange platform.

Quangvietdnbg posts a notice claiming it ranked first in trading on the cryptocurrency platform Paxful. Captured from Telegram

Quangvietdnbg warns users after saying that fake accounts impersonating the company had been discovered. Captured from Telegram

Quangvietdnbg promotes its donation of 50 bicycles to children. Captured from Telegram

At the same time, the company was actively seeking to purchase borrowed-name accounts, posting notices that it was looking for suppliers who could regularly provide Payoneer accounts in bulk. Payoneer offers accounts to companies such as Google, Amazon and Airbnb for paying overseas workers, and Quangvietdnbg appears to have considered accounts under American names advantageous for avoiding scrutiny.

Nowhere in Quangvietdnbg’s online activity was there any obvious sign of North Korean ties. Instead, it posted videos of bicycles being donated to underprivileged people and photos from a party marking its second anniversary, presenting itself as a legitimate IT company.

Experts, however, viewed the matter differently. Hwang Seok-jin, a professor at Dongguk University’s Graduate School of International Affairs and Information Security, described it as “digital hawala conducted without government authorization.”

"Hawala" refers to a trust-based money transfer system originating in South Asia.

Hwang said the company appeared to have acted as a high-risk money intermediary — effectively an exchange broker — laundering the proceeds earned by North Korean IT workers.

A post on Facebook offering to sell a Payoneer account for $60. Captured from Facebook.

Brazen operation, but hard to trace

Quangvietdnbg’s brazen laundering operation was made possible in part by Vietnam’s weak cryptocurrency oversight. Although Vietnam ranks among the world’s top countries in crypto adoption, it has no official exchange system, making peer-to-peer trading through platforms such as Facebook and Telegram commonplace. North Korea appears to have exploited this opaque trading environment to establish a channel for laundering funds.

This means larger sums can flow into North Korea while making the money harder to trace. The U.S. Treasury said North Korea generated nearly $800 million in revenue in 2024 alone, with much of the foreign currency used for developing nuclear weapons believed to have been obtained through cryptocurrency theft, fraud and laundering.

A search by Hankook Ilbo on Facebook using the keyword “Payoneer exchange” turned up around 200 related accounts. Posts offering to sell fully verified Payoneer accounts for $60 were also easily found.

Kim Seung-joo, a professor at Korea University’s Graduate School of Information Security, said that while the U.S. government has made efforts to track North Korea, including by offering rewards, companies often find it difficult to respond in a coordinated way because account verification and related procedures are complex.

Experts called for greater international coordination to cut off North Korea’s cross-border money laundering operations.

“North Korea disperses its servers and personnel across multiple countries — not only Vietnam, but also Laos and Spain — to avoid being tracked down,” Hwang said. “Given the clear limits of enforcement by individual countries alone, there is an urgent need to build an international real-time coordination network.”

This article from the Hankook Ilbo, the sister publication of The Korea Times, is translated by a generative AI system and edited by The Korea Times.